# Tautulli. Every CVE that names Tautulli among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Tautulli: Reflected XSS in \`/search\` endpoint](https://agentprime.io/advisories/CVE-2026-45381.md) `CVE-2026-45381` · CVE record: Tautulli Tautulli · CVSS 5.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS) - [Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter](https://agentprime.io/advisories/CVE-2026-49995.md) `CVE-2026-49995` · CVE record: Tautulli Tautulli · CVSS 4.8 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS) - [Tautulli: Open redirect via whitespace bypass in /auth/redirect](https://agentprime.io/advisories/CVE-2026-54915.md) `CVE-2026-54915` · CVE record: Tautulli Tautulli · CVSS 5.4 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Open redirect - [Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database](https://agentprime.io/advisories/CVE-2026-52835.md) `CVE-2026-52835` · CVE record: Tautulli Tautulli · CVSS 7.0 High · Not analysed yet · Published 21 Sept 2026 · Tags: Path traversal, Unrestricted file upload - [Tautulli vulnerable to unauthenticated SSRF in /image/\ via attacker-seeded image hash replay](https://agentprime.io/advisories/CVE-2026-43986.md) `CVE-2026-43986` · CVE record: Tautulli Tautulli · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Jun 2026 · Tags: Server-side request forgery (SSRF) - [Taultulli has CSRF in /configUpdate via missing anti-CSRF and method restriction that allows admin credential takeover](https://agentprime.io/advisories/CVE-2026-43985.md) `CVE-2026-43985` · CVE record: Tautulli Tautulli · CVSS 8.8 High · Not analysed yet · Published 4 Jun 2026 · Tags: Cross-site request forgery (CSRF) - [Tautulli has stored XSS in logFile via guest-controlled log_js_errors input](https://agentprime.io/advisories/CVE-2026-43984.md) `CVE-2026-43984` · CVE record: Tautulli Tautulli · CVSS 8.9 High · Not analysed yet · Published 4 Jun 2026 · Tags: Cross-site scripting (XSS) - [Tautulli Vulnerable to Unauthenticated/Authenticated Remote Code Execution via Newsletter Custom Template Directory](https://agentprime.io/advisories/CVE-2026-41065.md) `CVE-2026-41065` · CVE record: Tautulli Tautulli · CVSS 8.9 High · Not analysed yet · Published 4 Jun 2026 · Tags: Code injection - [Tautulli Vulnerable to Authenticated Path Traversal in Cache Deletion API](https://agentprime.io/advisories/CVE-2026-40605.md) `CVE-2026-40605` · CVE record: Tautulli Tautulli · CVSS 5.7 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Path traversal - [Tautulli: Unsanitized JSONP callback parameter allows cross-origin script injection and API key theft](https://agentprime.io/advisories/CVE-2026-32275.md) `CVE-2026-32275` · CVE record: Tautulli Tautulli · CVSS 7.4 High · Not analysed yet · Published 30 Mar 2026 · Tags: Cross-site scripting (XSS) - [Tautulli: SQL Injection in get_home_stats API endpoint via unsanitised filter parameters](https://agentprime.io/advisories/CVE-2026-31799.md) `CVE-2026-31799` · CVE record: Tautulli Tautulli · CVSS 4.9 Medium · Not analysed yet · Published 30 Mar 2026 · Tags: SQL injection, CWE-20 - [Tautulli: Unauthenticated Path Traversal in \`/newsletter/image/images\` endpoint](https://agentprime.io/advisories/CVE-2026-31831.md) `CVE-2026-31831` · CVE record: Tautulli Tautulli · CVSS 8.7 High · Not analysed yet · Published 30 Mar 2026 · Tags: Path traversal - [Tautulli: Unauthenticated pms_image_proxy endpoint proxies arbitrary HTTP requests through the Plex Media Server](https://agentprime.io/advisories/CVE-2026-31804.md) `CVE-2026-31804` · CVE record: Tautulli Tautulli · CVSS 4.0 Medium · Not analysed yet · Published 30 Mar 2026 · Tags: Server-side request forgery (SSRF) - [Tautulli: RCE via eval() sandbox bypass using lambda nested scope to escape co_names whitelist check](https://agentprime.io/advisories/CVE-2026-28505.md) `CVE-2026-28505` · CVE record: Tautulli Tautulli · CVSS 7.5 High · Not analysed yet · Published 30 Mar 2026 · Tags: Code injection - [Tautulli vulnerable to Authenticated Remote Code Execution via Command Injection](https://agentprime.io/advisories/CVE-2025-58763.md) `CVE-2025-58763` · CVE record: Tautulli Tautulli · CVSS 8.1 High · Not analysed yet · Published 9 Sept 2025 · Tags: Command injection - [Tautulli vulnerable to Authenticated Remote Code Execution via write primitive and \`Script\` notification agent](https://agentprime.io/advisories/CVE-2025-58762.md) `CVE-2025-58762` · CVE record: Tautulli Tautulli · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2025 · Tags: Path traversal - [Tautulli vulnerable to Unauthenticated Path Traversal in \`real_pms_image_proxy\`](https://agentprime.io/advisories/CVE-2025-58761.md) `CVE-2025-58761` · CVE record: Tautulli Tautulli · CVSS 8.6 High · Not analysed yet · Published 9 Sept 2025 · Tags: CWE-27 - [Tautulli vulnerable to Unauthenticated Path Traversal in \`/image\` endpoint](https://agentprime.io/advisories/CVE-2025-58760.md) `CVE-2025-58760` · CVE record: Tautulli Tautulli · CVSS 8.6 High · Not analysed yet · Published 9 Sept 2025 · Tags: Path traversal ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .